mosaicstack/stack
21
0
Fork 1
Code Issues 338 Pull Requests 13 Actions Packages Projects Releases 15 Wiki Activity

compose: add wrapper-first dogfood workspace (#1488)
ci/woodpecker/push/publish Pipeline was successful
Details

Browse Source 
Co-authored-by: marcie <[email protected]>
This commit was merged in pull request #1488.
This commit is contained in:
marcie
2026-08-30 22:29:30 +00:00
committed by orch-01
parent e18d13d36f
commit 736b0affc1
16 changed files with 1708 additions and 264 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/gateway.Dockerfile
+20 -2
View File
@@ -29,11 +29,29 @@ ENV NODE_ENV=production
# $MOSAIC_ROOT/.workspaces (apps/gateway/src/workspace/workspace.service.ts);
# mount a volume over /opt/mosaic to persist workspaces across container restarts.
# Intentionally unpinned: Alpine's signed repository is the trust anchor; pinning
# git was declined so routine base-image security updates remain maintainable.
RUN apk add --no-cache git \
# packages was declined so routine base-image security updates remain maintainable.
# bash/curl/python3 are runtime dependencies of the provider-neutral Mosaic git
# wrappers. jq supports wrapper discovery for non-canonical Gitea hosts.
RUN apk add --no-cache bash curl git jq python3 \
&& mkdir -p /opt/mosaic/.workspaces \
&& chown -R node:node /opt/mosaic /app
ENV MOSAIC_ROOT=/opt/mosaic
# Dogfood agents use the same fail-closed credential helper, queue guard, and
# PR-create wrapper as fleet seats. Copy only those operations and their shared
# dependencies. Merge and infrastructure tools stay out of the image.
COPY --from=builder /app/packages/mosaic/framework/tools/git/pr-create.sh /opt/mosaic/tools/git/pr-create.sh
COPY --from=builder /app/packages/mosaic/framework/tools/git/ci-queue-wait.sh /opt/mosaic/tools/git/ci-queue-wait.sh
COPY --from=builder /app/packages/mosaic/framework/tools/git/detect-platform.sh /opt/mosaic/tools/git/detect-platform.sh
COPY --from=builder /app/packages/mosaic/framework/tools/git/repo-decl.sh /opt/mosaic/tools/git/repo-decl.sh
COPY --from=builder /app/packages/mosaic/framework/tools/git/git-credential-mosaic /opt/mosaic/tools/git/git-credential-mosaic
# R4 hardening (P0-SEC, brain 15f6979a): the credential helper is a pair.
# python entrypoint (allowlist envp, execve boundary) + the bash implementation
# it execs. The entrypoint derives the .impl path from its own directory, so the
# pair sits side by side; system gitconfig keeps pointing at the entrypoint.
COPY --from=builder /app/packages/mosaic/framework/tools/git/git-credential-mosaic.impl /opt/mosaic/tools/git/git-credential-mosaic.impl
COPY --from=builder /app/packages/mosaic/framework/tools/_lib/credentials.sh /opt/mosaic/tools/_lib/credentials.sh
COPY --from=builder /app/packages/mosaic/framework/tools/structure/validate-repo-json.sh /opt/mosaic/tools/structure/validate-repo-json.sh
RUN git config --system credential.helper /opt/mosaic/tools/git/git-credential-mosaic
# Use the pnpm deploy output — resolves all deps into a flat, self-contained node_modules
COPY --chown=node:node --from=builder /deploy/node_modules ./node_modules
COPY --chown=node:node --from=builder /deploy/package.json ./package.json